GreyNoise Intelligence

Do know evil

Frequently Asked Questions

What do I use GreyNoise for?

The primary use-cases for GreyNoise are:

  • Distinguish between targeted and opportunistic/wide-spread attacks in your SIEM, reducing false positives and pointless alerts
  • Identify compromised devices in your network or in someone else's network
  • Find whether or not attackers are scanning the Internet for a given set of ports/services
  • Filter known-good scanners (like Shodan) from your logs
  • Identify emerging opportunistic threats

Where does the data come from?

We collect all of the data ourselves from a big network of constantly shifting servers in hundreds of data centers across the Internet

Why should I pay for Enterprise API access when there's a free open API?

  • The open alpha API is, indeed, merely an alpha API that was meant to be a proof of concept. It will be shut down in the near future. 
  • We don't officially support the alpha API
  • The alpha API doesn't include rights for commercial usage

What do I get with the Enterprise API access?

  • Commercial usage rights
    • You can incorporate our data into your products, with attribution
  • Real-time data access
  • Quick IP lookup endpoints
  • First class support
  • Access to raw data
  • Query by ASN / CIDR block / IP

If we implement GreyNoise to reduce false positives, much time will it save our SOC?

Our enterprise customers see an average of 25% alert reduction

Will prices change?

Yes. Prices will increase next year.

Can we pay an entire year upfront to lock in a price?

Yes. Just send a request to

Can we try before we buy?

Yes. Just fill out the form here.

Can sample the data without having to use any complicated APIs?

Yes. Check out our visualizer here.

I signed up for an Enterprise trial but never received my onboarding email

We filter free email addresses to reduce spam and abuse. Please use your professional or university email address.

Who can we give our feature request to?

Please send all feature requests to

I'm a student/researcher. Can I get access to GreyNoise for my research/school work/conference talk?

Absolutely. Email us at, preferably from your academic email address.

Can we OEM bulk GreyNoise data into our offering?

Most likely. Please reach out to us at 

Who runs this place?

GreyNoise Intelligence was founded and is operated by Andrew Morris